[WRONG BRANCH] fix(codex): guard native toggle teardown ownership

src/server/management/native-integration-routes.ts

@@ -234,6 +234,13 @@ async function handleCodexToggle(ctx: ManagementContext): Promise<Response> {
     }
     const enabled = body.enabled;
 
+    if (!enabled) {
+      // Restoring Codex mutates shared native artifacts. Refuse before even
+      // persisting intent when the installed service belongs to another home.
+      const owned = assertNativeTeardownOwned();
+      if (!owned.ok) return refusal(409, "codex", "home_mismatch", owned.message);
+    }
+
     const { setCodexIntegrationEnabled } = await import("../../codex/desired-state");
     const persisted = setCodexIntegrationEnabled(enabled);
     /*

tests/native-codex-toggle.test.ts

@@ -104,6 +104,25 @@ describe("request validation", () => {
 });
 
 describe("turning Codex off", () => {
+  test("refuses teardown owned by a service installed from another home", async () => {
+    writeFileSync(join(fixtureRoot, "service-state.json"), JSON.stringify({
+      version: 2,
+      codexHome: process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"),
+      opencodexHome: join(fixtureRoot, "foreign-opencodex-home"),
+      backend: "scheduler",
+    }));
+
+    const result = await put(baseConfig(), { enabled: false });
+
+    expect(result.status).toBe(409);
+    expect(result.body).toMatchObject({
+      code: "native_integration_refused",
+      clientId: "codex",
+      reason: "home_mismatch",
+    });
+    expect(persistedCodexIntent()).toBeUndefined();
+  });
+
   test("persists the decision so it survives the next start", async () => {
     const result = await put(baseConfig(), { enabled: false });
     expect(result.status).toBe(200);